This is version 2.4.5 of the Samhain manual.
Copyright © 2002-2023 Rainer Wichmann
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. You may obtain a copy of the GNU Free Documentation Licensefrom the Free Software Foundation by visiting their Web site or by writing to: Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
This manual refers to version 4.5.0 of Samhain.
Table of Contents
- 1. Introduction
- 2. Compiling and installing
- 3. General usage notes
- 1. How to invoke
- 2. Using daemontool (or similar utilities)
- 3. Controlling the daemon
- 4. Signals
- 5. PID file
- 6. Wait on file check
- 7. Log file rotation
- 8. Updating the file signature database
- 9. Improving the signal-to-noise ratio
- 10. Runtime options: command-line & configuration file
- 11. Remarks on the dnmalloc allocator
- 12. Support / Bugs / Problems
- 4. Configuration of logging facilities
- 5. Configuring samhain, the host integrity monitor
- 1. Usage overview
- 2. Available checksum functions
- 3. File signatures
- 4. Defining file check policies: what, and how, to monitor
- 4.1. Monitoring policies
- 4.2. File/directory specification
- 4.3. Suppress messages about new/deleted/modified files
- 4.4. Dynamic database update (modified/disappeared/new files)
- 4.5. Recursion depth(s)
- 4.6. Hardlink check
- 4.7. Check for weird filenames
- 4.8. Support for prelink
- 4.9. SELinux attributes and Posix ACLs
- 4.10. Codes in messages about reported files
- 4.11. Loose directory checking
- 4.12. Storing the full content of a file
- 4.13. Who made changes to a file?
- 4.14. Skip checksumming for particular files
- 4.15. Graceful handling of log rotation
- 4.16. No such user/group
- 5. Excluding files and/or subdirectories (All except...)
- 6. Timing file checks
- 7. Initializing, updating, or checking
- 8. The file signature database
- 9. Checking the file system for SUID/SGID binaries
- 10. Detecting Kernel rootkits
- 11. Monitoring login/logout events
- 12. Checking mounted filesystem policies
- 13. Checking sensitive files owned by users
- 14. Checking for hidden/fake/missing processes
- 15. Checking for open ports
- 16. Logfile monitoring/analysis
- 17. Checking the Windows registry
- 18. Modules
- 19. Performance tuning
- 20. Storing the full content of a file (aka: WHAT has changed?)
- 21. Inotify support on Linux (instantaneous reports, no I/O load)
- 6. Configuring yule, the log server
- 1. General
- 2. Important installation notes
- 3. Registering a client
- 4. Enabling logging to the server
- 5. Enabling baseline database / configuration file download from the server
- 6. Rules for logging of client messages
- 7. Detecting 'dead' clients
- 8. The HTML server status page
- 9. Chroot
- 10. Restrict access with libwrap (tcp wrappers)
- 11. Sending commands to clients
- 12. Syslog logging
- 13. Server-to-server relay
- 14. Performance tuning
- 7. Hooks for External Programs
- 8. Change Control Process Integration
- 9. Additional Features — Signed Configuration/Database Files
- 10. Additional Features — Stealth
- 11. Deployment to remote hosts
- 12. Security Design
- A. List of options for the configure script
- B. List of command line options
- C. Configuration file syntax and options
- 1. General
- 2. Files to check
- 3. Severity of events
- 4. Logging thresholds
- 5. Watching login/logout events
- 6. Checking for SUID/SGID files
- 7. Checking for mount options
- 8. Checking for user files
- 9. Checking for hidden/fake/required processes
- 10. Checking for open ports
- 11. Logfile monitoring/analysis
- 12. Database
- 13. Miscellaneous
- 14. External
- 15. Clients
- D. List of database fields
- E. List of recognized file types